FeaturesTrustSecurityPricingCompareConnect your AIBlogStart Free

Data room for

A data room for selling a UK owner-managed business

A corporate-finance boutique runs the sale, three to six bidders sign NDAs, and the owner's team has never built a data room. This page is the room for that deal: what UK data-protection guidance expects before employee data reaches a bidder, a folder index you can download, who should see what at each stage, and where a bigger platform is the better choice.

Updated 5 Oct 2026 · oldest fact checked 5 Oct 2026

The deal

How the process runs, and where the room comes in.

Most UK sales of an owner-managed company run the same way. An adviser prepares an information memorandum, a handful of trade and private-equity buyers sign NDAs, first-round offers narrow the field, and one buyer gets exclusivity and runs confirmatory diligence before signing. The data room opens at the second round and carries the deal to completion.

Two things make this deal type harder than it looks. The buyers often compete with each other, so nothing about one bidder may leak to another. And the most sensitive documents are about people: contracts, salaries, absence and disputes. UK GDPR applies to that data whether the sale is of shares or of assets, and the ICO has written down what it expects.

  1. Information memorandum
    Anonymised, no room yet
  2. NDAs and second round
    Room opens, groups per bidder
  3. Offers narrow the field
    Two or three groups stay
  4. Exclusivity
    Confirmatory folders open to one group
  5. Completion
    Room archived with its audit log
Each step changes who can see what. A group-based room makes each change one action.

What the rulebook says

The regulator's own words, dated.

The ICO's data sharing code and its employment guidance are the closest thing a UK sale has to a rulebook for the data room. The points below are the ICO's, quoted from its own pages and dated. They are not legal advice; your counsel decides how they apply to your deal.

Folder index

A starting index for this deal.

Adapt it to the company. Download it as CSV.

Folder index. Numbering keeps the order stable when the index is exported.
FolderDocuments
01 CorporateArticles of association; Register of members and PSC register; Shareholder agreements; Board minutes, last three years; Companies House filings
02 FinancialStatutory accounts, last three years; Management accounts, year to date; Financial model (workbook); Debt and security documents; Aged debtors and creditors
03 CommercialTop customer contracts (redacted until exclusivity); Key supplier contracts; Pipeline and order book; Pricing schedules
04 People (anonymised)Anonymised staff list: role, salary band, start date, notice; Template contracts and handbook; Pension scheme summary; Anonymised disputes summary
05 People (named, exclusivity only)Named staff list and contracts; Employee liability information where TUPE applies; Disputes and claims, named
06 PropertyLeases and licences; Title documents
07 IT and IPIP register; Software licences; Information security policy
08 Legal and complianceLitigation summary; Insurance schedule; Records of processing and data protection policies; Regulatory correspondence
09 TaxCorporation tax returns, last three years; VAT returns; HMRC correspondence
Folder index. Numbering keeps the order stable when the index is exported.

Who sees what

One group per party, changed one step at a time.

Participant groups and what each can open.
GroupSees
Each bidder, second roundFolders 01 to 04 and 06 to 09, at view level, watermarked. No named staff data, no unredacted customer contracts.
Shortlisted biddersThe same, plus the financial model with formulas switched on if you choose.
Exclusive buyerEverything, including folder 05, once the assurances the ICO describes are in writing.
Seller's advisersEverything, plus the Q&A queue and the audit log.
Participant groups and what each can open.

Where Sifrsys fits

The parts of this deal the product is built for.

Sifrsys fits this deal where the work is groups and questions. Each bidder is a group; moving a bidder to the next round is one change to the group, not forty re-shares. Each group accepts the room's NDA once before anything opens. The AI answers each bidder only from the folders that bidder's group can open, so the question a strategic buyer asks about churn cannot be answered from the named staff folder they do not have.

The financial model stays a workbook, watermarked on every rendered page, with formulas on or off per group. Every open, download, print and AI question is written to a hash-chained audit log, on every plan. For a boutique running two or three of these at once, the Data Rooms plan gives unlimited rooms.

  • One versioned NDA per room, accepted once per buyer group before anything in the room opens; click-wrap acceptance, no e-signature.
  • AI retrieval is filtered by each participant's permissions inside the SQL query, at the database level.
  • Dynamic watermark burned into each rendered page server-side, spreadsheets included.
  • Spreadsheets open as a server-rendered grid, with a per-group formula switch, print control and Fence view.
  • A hash-chained audit trail of document access on every plan, Free included.
  • Q&A workflow for due-diligence questions inside the room.

Choosing well

Where another product is the better choice.

Sources

Every rule on this page, with its URL.

Quoted from the regulator's own guidance on the date shown. Guidance changes. Check the date, and ask your counsel how it applies to your deal.

Questions

Questions advisers ask when setting up a UK sale room.

The ICO's employment guidance says to anonymise workers' information shared with a prospective buyer wherever possible, and to hand over named information only once the buyer has given assurances about how it will be used. A common pattern is an anonymised staff list for all bidders and a separate folder of named information opened to the exclusive buyer. Your counsel decides what your deal needs.
The ICO's guidance notes that some transfers, such as share takeovers, are outside the scope of TUPE, so the duty to provide employee liability information does not arise there. On an asset sale where TUPE applies, the information is due at least 28 days before the transfer completes.
Put each bidder in its own group, and do not give bidders a shared question board. In Sifrsys participants have no shared board: a question a participant escalates from an AI answer goes to the deal team, and the AI answers each group from that group's documents only.
The index on this page is a starting point for an owner-managed company: corporate, financial, commercial, people in two tiers, property, IT and IP, legal and compliance, and tax. Download it as CSV and adapt it to the deal.

Set up the room

Build the room before the second round.

Create a free room, import this index, and set up one group per bidder. Upgrade when the deal goes live.

Free to start · No per-page fees · No credit card required